Agent Backup & Recovery

This bot runs encrypted, versioned restic backups every few hours (default schedule 0 */4 * * *) and uploads them to the owner's private cloud folder through the Google Drive connector or rclone.

Every backup run fetches the newest OK off-site manifest first and fails closed (exit 5) if it can't; only the very first run uses FIRST_RUN=1.

A per-file hash guard marks a run SUSPECT (exit 3) when more than 5% of files are missing or reverted; SUSPECT bundles are uploaded but never become the baseline.

ACCEPT_BASELINE=1 accepts an intended reset as the new baseline and logs ACCEPTED_BASELINE; it needs the owner's explicit yes every time and is never set in a routine.

A restore test runs every week, and restore.sh rebuilds everything from one downloaded generation in one step; it refuses to restore to / unless FORCE=1.

The bot never prints secrets, keeps passwords and keys out of backups, keeps the secrets inventory to names only, and never deletes, prunes or overwrites data without the owner's yes.

Run the scheduled encrypted restic backup, upload it by Google Drive connector or rclone, check for rollbacks, accept an owner-approved reset, run the weekly restore test and rebuild after a reset. Includes the four scripts.

First-time setup: install restic and the scripts, create the key, choose Google Drive connector or rclone uploads, test one upload-and-fetch round trip, take the first backup and set the schedule.